[intel352]

Summary

• build all real RISC Zero guest methods once on the supported Linux amd64 host and distribute a strict checksum-verified bundle to native asset jobs
• embed the same nonzero guest IDs and combined guest binaries into Linux/macOS amd64/arm64 backend and bridge assets, including the transitive tracer guest
• provision protoc, keep the RISC Zero install token scoped to the install step, and prove the packaged Linux backend without build-only RISC Zero tools
• attest both publisher provenance and an explicit predicate binding the originating release SHA/run/ref
• reject guest-bundle manifest symlinks before reading or parsing their targets

Failure addressed

Main release run 29244296832 showed that RISC Zero 3.0.5 publishes cargo-risczero only for Linux amd64 and macOS arm64, while the supported hosts that reached compilation lacked protoc. The native jobs no longer install unavailable guest toolchains.

Verification

• cargo test -p encrypted-spaces-bridge --locked -- --test-threads=1 (55 passed, 1 real-proof release test ignored)
• focused guest-bundle tests compile normalized methods and reject binary tampering, methods substitution, payload symlinks, and manifest symlinks before parsing
• RISC0_SKIP_BUILD=1 RISC0_DEV_MODE=1 cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo fmt --all -- --check
• python3 -m py_compile .github/scripts/prepare-encrypted-spaces-guest-bundle.py
• actionlint .github/workflows/release-bridge.yml .github/workflows/release-publish.yml
• scope-manifest lock check passed

Regression proof

With the manifest path validation reverted:

$ cargo test -p encrypted-spaces-bridge --locked guest_bundle_tool_normalizes_and_verifies_generated_methods -- --exact
FAILED - manifest was read before symlink validation; json.loads followed the external symlink and raised JSONDecodeError

With the fix restored:

$ cargo test -p encrypted-spaces-bridge --locked guest_bundle_tool_normalizes_and_verifies_generated_methods -- --exact
ok - 1 passed; 0 failed

The hosted main release run remains the authoritative real guest build, packaged real-proof, and four-platform asset gate.

[Copilot]

Pull request overview

This PR makes the release pipeline portable across supported runner architectures by building the real RISC Zero guest methods once on a supported host, packaging them into a checksum-verified bundle, and reusing that bundle to embed identical guest binaries/IDs into all native release assets. It also strengthens release attestations by adding an explicit predicate that binds the published artifacts back to the originating release SHA/run/ref.

Changes:

• Adds a “guest-methods” job to build/normalize/verify guest methods once, then downloads & verifies that bundle in native asset jobs before embedding it.
• Introduces shared Rust build-script helper (prebuilt_guest.rs) and a Python bundle tool to create/verify an architecture-independent guest bundle.
• Enhances publisher workflow attestations to include both provenance and an explicit “release source binding” predicate.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
PATCHES.md	Updates the upstream-delta ledger to reflect the new guest-bundle + attestation approach.
ffproof/tracer/methods/build.rs	Adds prebuilt guest embedding support before falling back to risc0_build::embed_methods().
ffproof/prebuilt_guest.rs	New helper for copying prebuilt methods.rs into OUT_DIR and exporting the bundle path to rustc.
ffproof/methods/build.rs	Uses the prebuilt-guest embedding helper when available.
ffproof/client_methods/build.rs	Uses the prebuilt-guest embedding helper when available.
bridge/tests/runtime.rs	Extends release-contract tests and adds bundle-tool integration tests.
.github/workflows/release-publish.yml	Adds an explicit source-binding predicate attestation alongside provenance.
.github/workflows/release-bridge.yml	Adds “guest-methods” job and updates asset/gate jobs to download+verify+embed the guest bundle (and provision protoc).
.github/scripts/prepare-encrypted-spaces-guest-bundle.py	New tool to create/verify a strict guest bundle (manifest + SHA256SUMS + normalized methods.rs).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.